CVE-2025-62593 Ray-Project Ray Code Injection
Attackers can achieve remote code execution on developers' machines by exploiting DNS rebinding and insufficient browser header validation in Ray.
- Exploited in the wild
- Since 17 Aug 2026
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2025-62593?
CVE-2025-62593 is a critical server-side request forgery vulnerability in ray-project ray, published on 26 Nov 2025. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Ray is an AI compute engine. Prior to version 2.52.0, developers working with Ray as a development tool can be exploited via a critical RCE vulnerability exploitable via Firefox and Safari. This vulnerability is due to an insufficient guard against browser-based attacks, as the current defense uses the User-Agent header starting with the string "Mozilla" as a defense mechanism. This defense is insufficient as the fetch specification allows the User-Agent header to be modified. Combined with a DNS rebinding attack against the browser, and this vulnerability is exploitable against a developer running Ray who inadvertently visits a malicious website, or is served a malicious advertisement (malvertising). This issue has been patched in version 2.52.0.
Which versions are affected by CVE-2025-62593?
3 open source packages ship an affected version, including ray. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
ray PyPI | All versions | 2.52.0 |
ray PyPI | All versions | 2.52.0 |
ray PyPI | All versions | 2.52.0 |
Products include Anyscale Ray.
How do I fix CVE-2025-62593?
Upgrade ray to 2.52.0 or later. US federal agencies must fix it by 20 Aug 2026.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2025-62593 being exploited?
Yes. Attackers have exploited CVE-2025-62593 in the wild since at least 17 Aug 2026.
Public exploit code: 1 Nuclei template and 2 proofs of concept on GitHub.
Other vulnerabilities in ray-project ray
- CVE-2023-48022 Ray has arbitrary code execution via jobs submission API
- CVE-2023-48023 Server-side request forgery in n/a
- CVE-2026-41486 Ray: Remote Code Execution via Parquet Arrow Extension Type Deserialization
- CVE-2026-32981 Ray Dashboard <= 2.8.0 Path Traversal Leading to Local File Disclosure
- CVE-2026-57516 Ray < 2.56.0 Unsafe Deserialization RCE via WebDataset Reader
Sources
Also known as GHSA-q279-jhrf-cc6v, MINI-7qrw-8cwr-pcrr, MINI-rfwh-cfg3-jf99, PYSEC-2026-520.